From afdf4107b3fbbc878e19b1b9c04f7b33d61abcaf Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Wed, 4 Jul 2018 16:31:40 +0200 Subject: [PATCH] Bug 21036: Fix CGI::param in list context warning from opac-passwd.pl Content-Type: text/plain; charset=utf-8 Resolve: CGI::param called in list context from package CGI::Compile::ROOT::usr_share_koha_prodclone_opac_opac_2dpasswd_2epl line 55, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436. Add a scalar. Test plan: Speaks for itself. --- opac/opac-passwd.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/opac/opac-passwd.pl b/opac/opac-passwd.pl index b5ae895..5be984e 100755 --- a/opac/opac-passwd.pl +++ b/opac/opac-passwd.pl @@ -55,7 +55,7 @@ if ( C4::Context->preference("OpacPasswordChange") ) { my $error; my $new_password = $query->param('Newkey'); my $confirm_password = $query->param('Confirm'); - if ( goodkey( $dbh, $borrowernumber, $query->param('Oldkey') ) ) { + if ( goodkey( $dbh, $borrowernumber, scalar $query->param('Oldkey') ) ) { if ( $new_password ne $confirm_password ) { $template->param( 'Ask_data' => '1' ); -- 2.1.4